Independent Journalist specializing in Cybercrime Interviews and News.
Joined March 2012
- Tweets311
- Following776
- Followers56
- Likes23
I really appreciate you sharing this given your firsthand experience with the incident. I am eager to learn more about the forensics! ..and I don't want to minimize the disruption or data loss staff experienced.
If you're comfortable sharing more please do!
Thank you for sharing your perspective!
My goal in reaching out to BYOD was to understand their account, not endorse it. If you're comfortable sharing, could you elaborate on the Intune attack vector and what people experienced during recovery? I'd value that context.
I appreciate BYOD taking the time to share its perspective and provide additional context about the incident. Their response offers further insight into their account of what happened, and I hope continued dialogue will help bring greater clarity to the situation.
BYOD argues that a README file left on affected devices supports its claim that the attack was intended to target the university, not hospital operations.
The group says the file repeatedly referenced the university and described the data being locked as informational.
BYOD says it offered decryption keys for healthcare-related files after learning of reported ambulance diversions and patient redirection.
The group also claims it offered eligible patients up to $2,500 in compensation for disruption to their care.
One of BYOD's central claims: it says it encrypted informational data but did not lock active applications or critical care systems.
The group also alleges UNM Hospital advised staff to turn off devices.
BYOD claims most of the data it accessed consisted of small, compressed files associated with old, inactive accounts labeled scim__users_{numerical_identifier}.
The group says it interpreted these as forgotten university devices and user data.
BYOD claims its original target was the University of New Mexico, not UNM Hospital (UNMH).
The group says both entities shared a network and group policy, which allegedly contributed to hospital-related data being caught up in the attack.
I reached out directly to BYOD regarding the attack on UNM and received a response.
I've shared in the thread below.
@UNM, I'd welcome your perspective on these claims, particularly regarding the impact on UNM Hospital and the reported disruption to patient care
🧵👇
The threat actor shared their account of what happened with me, please check my page for their response!